DeadBolt Ransomware

Summary

QNAP recently detected a new DeadBolt ransomware campaign. According to victim reports so far, the campaign appears to target QNAP NAS devices running outdated versions of QTS 4.2.x, 4.3.x and 4.4.x, and outdated applications.

QTS 4.5.x, and 5.0.x, and QuTS hero h4.5.x and h5.x, with updated applications, are not affected.

Recommendation

To secure your NAS, we strongly recommend updating QTS or QuTS hero and all applications in App Center to the latest version immediately.

If you are using QTS 4.2.x or 4.3.x, we recommend one of the following builds to ensure your device is safe from the ransomware:

• QTS 4.3.6.2050 build 20220526 and later
• QTS 4.3.4.1976 build 20220303 and later
• QTS 4.3.3.2057 build 20220623 and later
• QTS 4.2.6 build 20220623 and later

If you are using QTS 4.4.x, we recommend upgrading to one of the following versions:

• QTS 4.5.x
• QTS 5.x

Regardless of which QNAP operating system version you are using, please update all applications on your NAS to the latest versions.

What if my NAS has already been compromised?

If your NAS has already been compromised, take a screenshot of the ransom note to keep the bitcoin address, and then upgrade to the latest firmware version. The built-in Malware Remover application will automatically quarantine the ransom note that hijacks the login page.

If you want to input a received decryption key and are unable to locate the ransom note after upgrading the firmware, please contact QNAP Support for assistance.

Updating QTS or QuTS hero

1. Log on to QTS or QuTS hero as an administrator using one of the following URLs in a web browser:
   • http://nas_ip:8080/cgi-bin/index.cgi
   • https://nas_ip/cgi-bin/index.cgi
     Note: Replace "nas_ip" with your NAS IP address. 
2. Go to Control Panel > System > Firmware Update.
3. Under Live Update, click Check for Update.
   QTS or QuTS hero downloads and installs the latest available update.

Tip: You can also download the update from the QNAP website. Go to Support > Download Center and then perform a manual update for your specific device.

Updating All NAS Applications

1. Log on to QTS or QuTS hero as administrator.
2. Open App Center.
3. Locate Install Updates on the upper right corner of the screen.
4. Click All.
   A confirmation message appears.
5. Click OK.
   QTS or QuTS hero updates all installed applications.